@vercel/remix-builder

Build provenancecaution

The release has no attestation or staged publishing, leaving provenance less transparent despite the package's active organizational backing.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, which creates some ownership ambiguity; the Vercel monorepo context partly compensates.

Workflow auditcaution

The audit covered 24 workflows but one file failed; it found high-confidence template-injection hygiene findings, many unpinned actions, and trusted publishing, though no untrusted checkout or script-injection sink was found.